Typically this will be true. The InsertionIP field indicates the machine that generated the event, and the computer that the user attempted to log on to should generate the event. However in practice, I would probably use the destinationIP field instead.
↧